Feature/6586 add feature for wfs subsetting

[NekoLyn]

if run locally: baseUrl = http://localhost:8080/api/v1/ogc
if run in edge: baseUrl = https://ogcapi-edge.aodn.org.au/

example SUCCESS request
GET {{baseUrl}}/collections/collectionId/items/downloadableFields?serverUrl=https://geoserver-123.aodn.org.au/geoserver/wfs&layerName=imos:aatams_sattag_dm_profile_map

Response

[
    {
        "label": "timestamp",
        "type": "dateTime",
        "name": "timestamp"
    },
    {
        "label": "geom",
        "type": "geometrypropertytype",
        "name": "geom"
    }
]

example exception 403:

{
    "timestamp": "2025-07-29T03:14:27.464209412",
    "message": "Access to WFS server 'https://geoserver.imas.utas.edu/geoserver/wfs?' is not authorized. Only approved servers are allowed.",
    "details": "uri=/api/v1/ogc/collections/collectionId/items/downloadableFields"
}

example exception 404:
GET {{baseUrl}}/collections/collectionId/items/downloadableFields?serverUrl=https://geoserver.imas.utas.edu.au/geoserver/wfs?&layerName=imas:IMAS_BRUV_clips_video

{
    "timestamp": "2025-07-28T05:19:31.108343671",
    "message": "No downloadable fields found for typeName 'imas:IMAS_BRUV_clips_video' from WFS server 'https://geoserver.imas.utas.edu.au/geoserver/wfs?'",
    "details": "uri=/api/v1/ogc/collections/collectionId/items/downloadableFields"
}

example exception 403:
GET {{baseUrl}}/collections/collectionId/items/downloadableFields?serverUrl=https://geoserver.imas.utas.edu/geoserver/wfs?&layerName=imas:IMAS_BRUV_clips_video

{
    "timestamp": "2025-07-29T03:14:27.464209412",
    "message": "Access to WFS server 'https://geoserver.imas.utas.edu/geoserver/wfs?' is not authorized. Only approved servers are allowed.",
    "details": "uri=/api/v1/ogc/collections/collectionId/items/downloadableFields"
}

example exception 400:
GET {{baseUrl}}/collections/collectionId/items/downloadableFields?layerName=imas:IMAS_BRUV_clips_video

[utas-raymondng]

Minor change request

[utas-raymondng]

LGTM

[utas-raymondng]

It would be good if you can remove the serverURL in the next PR and look it up using the UUID. Then user cannot change the URL in the query which is more secure

[NekoLyn]

It would be good if you can remove the serverURL in the next PR and look it up using the UUID. Then user cannot change the URL in the query which is more secure

Thanks! I created a ticket for this issue
https://github.com/aodn/backlog/issues/7198